Agentscore
Scan MCP packages and repos for trust and exposure risks before you wire unknown servers into Claude Code or Cursor.
Overview
agentscore is a MCP server for the Ship phase that acts as a security trust layer to scan MCP packages, inspect repos, and monitor exposure and changes.
What is this MCP server?
- MCP-focused security trust layer for packages and repositories
- Checks exposure and monitors changes over time (v2.2.0 npm server)
- stdio transport via @agentscore-xyz/mcp-server
- Complements manual README trust with structured inspection tooling
- Use before adding community MCP servers to daily agent config
- Registry version 2.2.0
- npm identifier: @agentscore-xyz/mcp-server
- Transport: stdio
What problem does it solve?
You are one npm install away from giving an unreviewed MCP server broad access with no structured trust check.
Who is it for?
Security-conscious solo builders who frequently add community MCP servers and want agent-callable trust checks.
Skip if: Builders who only use first-party MCP with no third-party packages, or teams already running full enterprise SCA with manual gates.
What do I get? / Deliverables
You can run package and repo trust inspections through MCP before committing servers to your agent workflow and revisit signals when things change.
- Agent-invokable trust and exposure checks on MCP-related packages and repos
- Change-awareness signals to re-evaluate previously trusted MCP dependencies
Recommended MCP Servers
Journey fit
How it compares
MCP supply-chain trust MCP server, not an application penetration-test skill or generic code linter.
Common Questions / FAQ
Who is agentscore for?
Indie developers and small teams who rely on MCP integrations and want a dedicated trust layer before granting tool access to agents.
When should I use agentscore?
Before installing or upgrading third-party MCP servers, and when monitoring whether those dependencies or repos changed in risky ways.
How do I add agentscore to my agent?
Add the npm package @agentscore-xyz/mcp-server as a stdio MCP entry in Claude Code or your host, then invoke its scan and inspect tools from a session.